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Changing Flight Crew Roles 

Advanced avionics through flight management systems (FMS) coupled with autopilots can now 
precisely control aircraft from takeoff to landing. Clearly, this has been the most important 
improvement in aircraft since the jet engine. Regardless of the eventual capabilities of this 
technology, it is doubtful that society will soon accept pilotless airliners with the same aplomb 
they accept driverless passenger trains. Flight crews are still needed to deal with inputing 
clearances, taxiing, in-flight rerouting, unexpected weather decisions, and emergencies; yet it is 
well known that the contribution of human errors far exceed those of current hardware or 
software systems. Thus human errors remain, and are even increasing in percentage as the 
largest contributor to total system error. 

Currently, the flight crew is regulated by a layered system of certification: by operation, 
e.g., airline transport pilot versus private pilot; by category, e.g., airplane versus helicopter; by 
class, e.g., single engine land versus multi-engine land; and by type (for larger aircraft and jet 
powered aircraft), e.g., Boeing 767 or Airbus A320. Nothing in the certification process now 
requires an in-depth proficiency with specific types of avionics systems despite their prominent 
role in aircraft control and guidance. 


New System Information 


New systems now emerging will undoubtedly add safety to aircraft operating in the future 
airspace system, but the added information processing required to operate in that system will 
probably increase, not decrease, the crews’ overall mental workload. For example, the 
capabilities of the Global Navigational Satellite System (GNSS) will eventually allow 
“uplinking” of the positions of individual aircraft via Automatic Dependent Surveillance (ADS), 
which could include data quantifying weather conditions surrounding each aircraft. The 
consolidation of specific traffic and weather into a national, even global, information network 
could be re-transmitted on demand to equipped aircraft. Moreover, air traffic control equipped 
with comprehensive and real time data about traffic and weather events in the airspace could 
dynamically manipulate airspace restrictions and uplink new configurations to cockpit electronic 
maps. 
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Even individual aircraft flight management systems could be automatically re-programmed 
from the ground for more efficient routing, then activated by acknowledgement from the crew. 
All this can provide crews with rich information about traffic, weather, and the airspace 
surrounding their aircraft, but it also increases monitoring responsibilities. 


Monitoring 

In the attempt to try to convey all information (without prioritization), the danger may be that 
there will be less knowledge conveyed (by overloading information). Design philosophy will 
play a role; some air carrier manufacturers (e.g.. Airbus Industrie) prefer to display the status of 
many ongoing events and data, presumably with the objective to keep the crew better informed 
and aware. Other manufacturers (e.g., Boeing) choose to display principally abnormal status 
items, presumably protecting crews from lowering their attention by becoming accustomed to 
overlooking normal data. The implications of such designs are echoed in the ongoing debate 
about the effect of datalink cutting off “party line” monitoring of common radio frequencies. 
One side argues that crews are losing valuable situation awareness information by eliminating 
broadcasts from surrounding aircraft; the other side contends it is better to filter out all non- 
essential communications. 


Supervision 

Flight crews may have an even greater challenge supervising automated flight control systems 
than by actually performing tasks themselves. As Dr. Earl A. Wiener put it, "... bigger 
mistakes are made more often while supervising, than when in direct control” (Wiener, 1990). 
This may be due, in part, to less involvement by the crew; thus the potential for divided 
attention and larger casual errors. In addition, autopilots in the past were programmed to or 
from single ground reference points or altitude. These were easily remembered, and flight 
crews were kept involved as they made simple speed, time, and fuel calculations. 

Today's flight management systems (flight-controlled autopilot coupled or not) have the 
programming and sequencing capabilities for dozens of navigational routes, flight profiles, and 
hundreds of waypoints far beyond the working memory of the crews. On-board computers 
(with databases) can processes information with ease and precision, leaving manual calculations 
pass6 and crews ever more dependent on system processing. Moreover, automatic sequencing 
is for the most part externally initiated at points of passage or interception, sometimes leaving 
the crews with the question “How in the world did I ever get into that mode?” (Sarter & 
Woods, 1994). The problem is that crew members may lose their awareness of the automated 
mode changes in their role shift from that of a supervisor anticipating future events to that of a 
monitor of lagging events. Often hardware and software are not designed to allow easy crew 
surveillance. Worse yet, mindless dependency on computer reliability, without mental 
supervision checking, produces the three most commonly asked questions on highly automated 
flight decks - “What is it [the flight management system] doing? Why is it doing it? What will it 
do next?” (Wiener, 1990). 
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Since current avionics are more likely to be integrated with aircraft controls, the 
consequences of errors are greater than even only a few years ago. The potential for errors 
extends across mistaken inputs (dumb use, i.e., non-checked use), misunderstood algorithms 
(misuse), and inadequate time for programming changes (rushed use). For example, 
transposition errors during the entry of latitude/longitude coordinates were implicated in the 
shoot down of Korean Airline 007 and in the 1977 collision of an Air New Zealand into Mount 
Erebus, Antarctica. Mode verification was apparently not done in the Airbus (A320) accident at 
Strasbourg, France, Air Inter Flight 148. The crew misinterpreted a desired flight path angle 
3.3° for a vertical speed value of 3.3 x 1000 ft/min because both are entered into the same 
display. However, which one is active depends on the current mode (Monnier, 1992). As a 
final example, the slow response of a China Airlines crew in disengaging the autopilot during 
an engine failure in a Boeing 747 over the Pacific, resulted in a rollover and near terminal dive. 

Thus, regardless of the level of automation, the pi lot- in-command (PIC) remains the final 
authority. The FMS/FGS as an electronic crew member is not yet deemed capable of replacing 
the PIC's judgment. These systems currently perform exactly as programmed, yet they are not 
yet equipped with the artificial intelligence to correct PIC errors or suggest alternatives to a 
proposed PIC course of action. Moreover, in an informal survey we conducted, flight crews in 
both a Boeing 767 and an Airbus 320 did not know the manufacturer or the model of their 
“electronic” crew member, the FMS, admitting they were not fully aware of the full range of its 
capabilities, limitations, idiosyncracies, and underlying strategies. 


Proposal 

It is proposed that flight crews be certified for attaining mastery of sophisticated control 
systems. Perhaps the type of aircraft plus the type of FMS should become a new integrated 
type of aircraft/FMS certification, e.g., a B767 /A(fmS) or 6767/6^5). (Note, it is recognized 
that it becomes a judgment call as to when A (FMS ) and B (FMS) are “significantly different” to 
require a different type rating.) Extending beyond automated flight control is the possible 
certification of crews to use software-specific navigational systems (FGS) which provide 
guidance during instrument flight operations. Given that manual control is often based on the 
same information displayed through the flight director that drives coupled systems, the 
argument for certification for use of uncoupled systems is just as compelling in EFR conditions. 

An advantage to FMS/FGS certification beyond the demonstration of competency is that it 
provides hardware, software, and instructional system designers with human performance 
benchmarks to guide the design or training system process so as to best accommodate the 
human component. It also begins to insure that the total system (hardware, software, and 
people) will meet expected standards. 


Justification 


The basis for this proposal is that the traditional role of the flight crew is swiftly changing. 
Hands-on flight control is rapidly giving way to semi -automated or fully automated control 
even for the most routine operations. So much so that some long-haul crews that use 
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automation for their infrequent takeoffs and landings fear losing their basic flight proficiency. 
Lower psychomotor effort without the need for constant attention to direct flight control has 
translated directly to a greater opportunity for monitoring and supervising flight systems, but 
only for crews who are highly FMS proficient. For low proficiency crews, the “mental” 
workload may be heavier. While certain mundane tasks such as navigational and altitude 
tracking are automated, additional capabilities and requirements are being added to the flight 
deck. This not only serves to supplant the “free time,” but belies the mental effort involved in 
conducting the safest possible flight. 


Testing 


Testing should be done with the total system (i.e., the particular flight management system with 
a particular type of aircraft) to uncover any idiosyncratic aspects of system integration. The type 
certificate for aircrews should read, “(aircraft type)/FMS”. Note that testing should consider 
both crew competency with the manufacturer’s standard configuration as well as with their 
utilization of customized features. Unlike the past, the depth of testing should go well beyond 
just “how to use the system.” In order to maintain mode awareness, the crew must know “how 
the system works” at a deeper structure - (based on a mental model) at least at a macro-level - 
and have the ability to track what the system is doing at any given time. For example, current 
FAA testing is for type ratings with the FMS fully functional and fully operational. In prior 
years, examiners turned ^equipment to increase the difficulty level. A deeper understanding 
of the system(s) would be demonstrated with partial levels of automation and no automation - 
e.g., scenario manipulation to infer situation awareness (Sarter & Woods, 1994). Perhaps more 
importantly, crews should be able to accurately predict what the system will do next, allowing 
for anticipation of automated programming changes or hardware/software errors in the making; 
“thinking ahead of the aircraft” (Regal et.al., 1988). 
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